This module provides routines for safely exposing IO functions in
the LIO monad. At a high level, certain IO objects such as
handles can be associated with a label via LObj, while certain
operations can then be blessed (via blessTCB) to operate on such
LObj objects.

Documentation

A "LObj label object" is a wrapper around an IO abstraction
of type object (such as a file handle or socket) on which it is
safe to do IO operations in the LIO monad when the caller can
read and write a the label label. It is the job of the trusted
code constructing such a LObj object to ensure both that the same
IO object is only ever associated with a single label, and that the
abstraction combined with its blessed IO operations (see
blessTCB) cannot be used to communicate with code running at
different labels.

This function can be used to turn an IO function into an LIO
one. The LIO version expects a LObj argument, and before
performing any IO uses guardWrite to check that the current label
can write the label in the LObj object.

The first argument should be the name of the function being defined
with blessTCB. Its purpose is to enhance error reporting.

Note that io and lio are function types (of up to nine
arguments), which must be the same in all types except the monad.
For example, if io is Int -> String -> IO (), then lio must
be Int -> String -> LIO l ().